{
  "id": "POL-191",
  "slug": "pol-191",
  "title": "The terms must say the opt-in applies to this programme only",
  "statement": "The SMS terms must state that the opt-in applies only to this brand's programme and is not transferable or assignable.",
  "rationale": "CTIA states that an opt-in should not be transferable, and putting it in the terms is what turns the principle into something the subscriber has been told. Its absence is what a reviewer reads when they are deciding whether a brand understands that consent names a sender — the whole affiliate-marketing prohibition rests on the same idea.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "SMS terms body",
  "severity": "HIGH",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "sms_terms",
  "authorities": [
    "CTIA",
    "Twilio",
    "Bandwidth"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30932",
      "remediable": true,
      "generation": "gen2"
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Add the sentence to the terms, naming the brand rather than saying \"us\". Done when the document states that the consent covers this programme and travels nowhere.",
  "example": "Your consent covers the Acme Coffee Rewards programme only. We do not transfer or assign it to any other business, including any company that might acquire us.",
  "notes": "The positive form of POL-072, which fails a document that describes consent as assignable. This one fails a document that says nothing.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-191/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-191.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}